I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here.
I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-built http server (which relies on mDNS/Bonjour) was replacing the genuine computer name with a domain name that is linked to my ISP (telenet.be).
When I navigated to the url (at first by accident as that's how I discovered the issue) it was blocked by safari as being unsafe. I checked with Google transparency report and it also confirmed it was unsafe:
as well as the subdomain :
I contacted Codekit who confirmed that all the software does is request the computer name. Using Wireshark I confirmed that was what it was doing, and that the response it got was correct. Although I'm not an expert Wireshark user and reading beyond that may give clues.
Bryan at Codekit mentioned that he believed sometimes ISPs abuse Bonjour on the local network, and that could be happening here. I concluded that if it was the router behaving badly Google Transparency report would not have flagged it as it would not really be aware of LAN mDNS issues.
I have also noticed another artifact. Codekit can generate a self-signed certificate for using https on it's http server. When I am disconnected from the router, the certificate has the expected DNSName entries when it is generated. However when I connect to the router, when codekit generates the certificate, it includes two additional DNS Names which seem related to the issue:
Also I have tried connecting via a personal hotspot from my phone's 4G service (ie avoiding the router) and the problem does not occur at all. In fact I've tried so many times I'm certain that it isn't my Mac that has the problem, as it probably should occur regardless of how I access the internet. So from this perspective I believe it has something to do with the mDNS bonjour service.
I contacted the ISP to ask them to check their subdomain content, and DNS records and to verify that they were not inadvertantly hosting malware, and to request a replacement router to do an A/B test. I was told at first (no joke) to restart my router. Then they said they'd replace the router for a fee. I should also add that the ISP do not allow direct access to the admin panel of the router, instead you have to go via their website (yes I did say that) to set up port forwarding, network passwords etc...
After many days of conversations and further investigation, I think that there are three likely scenarios, outlined in the title, but my technical abilities on how to deal with this are exhausted. I seem to be going round in circles with the ISP, they either know about this and are not willing to do anything about it, or they just don't have the techncal expertise to understand what is going on.
Hence the post here. Can anyone shed some light on this?